Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\npfs.sys Base=0x1C0000000 SHA-256=D3212C5460D52F4EC0CD22D1413B7C73D3C78ACF377AA7DF34A4C609C0A772EC
PDB: npfs.pdb GUID={C22F4F02-1918-F155-C339E2B1F02D2850} Age=1

322 located named symbols:
0x1C0007220: "__cdecl _imp_IoAllocateIrp" __imp_IoAllocateIrp
0x1C000CE00: NpCommonFileSystemControl
0x1C0010B80: NpFsdQuerySecurityInfo
0x1C000F720: NpFreeFcb
0x1C000A180: NpPeek
0x1C0007038: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C0007330: "__cdecl _imp_KeSetTimer" __imp_KeSetTimer
0x1C00153E4: NpDeleteDevice
0x1C00155A0: NpSiloContextCleanup
0x1C0005008: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C00071A0: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C0007228: "__cdecl _imp__stricmp" __imp__stricmp
0x1C00072B0: "__cdecl _imp_ObReferenceSecurityDescriptor" __imp_ObReferenceSecurityDescriptor
0x1C00071E8: "__cdecl _imp_PsGetCurrentSilo" __imp_PsGetCurrentSilo
0x1C0007230: "__cdecl _imp_ObfDereferenceObjectWithTag" __imp_ObfDereferenceObjectWithTag
0x1C00154C8: NpSiloArrival
0x1C000F7F0: NpFreeCcb
0x1C0007250: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C00139DC: NpEventsSelect
0x1C0007240: "__cdecl _imp_ExEventObjectType" __imp_ExEventObjectType
0x1C00014D0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0007140: "__cdecl _imp_IoGetRequestorProcess" __imp_IoGetRequestorProcess
0x1C00070B0: "__cdecl _imp_SeAccessCheck" __imp_SeAccessCheck
0x1C0007260: "__cdecl _imp_IoCreateDevice" __imp_IoCreateDevice
0x1C00070C0: "__cdecl _imp_SeAssignSecurity" __imp_SeAssignSecurity
0x1C0007040: "__cdecl _imp_SeQueryInformationToken" __imp_SeQueryInformationToken
0x1C00072D8: "__cdecl _imp_PsAttachSiloToCurrentThread" __imp_PsAttachSiloToCurrentThread
0x1C0007158: "__cdecl _imp_MmProbeAndLockPages" __imp_MmProbeAndLockPages
0x1C00109B0: NpCreateDefaultRootSecurity
0x1C0007088: "__cdecl _imp_IofCompleteRequest" __imp_IofCompleteRequest
0x1C00033B0: "%wZ\%lu-%lu-%lu-%lu" ??_C@_1CI@PNPBKE@?$AA?$CF?$AAw?$AAZ?$AA?2?$AA?$CF?$AAl?$AAu?$AA?9?$AA?$CF?$AAl?$AAu?$AA?9?$AA?$CF?$AAl?$AAu?$AA?9?$AA?$CF?$AAl?$AAu?$AA?$AA@
0x1C0015D84: NpDeleteSymlink
0x1C00072D0: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1C000A7BC: NpCreateExistingNamedPipe
0x1C000FF70: NpCompleteTransceiveIrp
0x1C0014F94: NpSelectEvents
0x1C0007388: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C0013B80: NpQueryInternalInfo
0x1C0007188: "__cdecl _imp_ExAcquirePushLockSharedEx" __imp_ExAcquirePushLockSharedEx
0x1C000AA20: NpCreateNamedPipePrefix
0x1C000BC50: NpCreateClientEnd
0x1C0015754: NpCreateSymlink
0x1C0007350: "__cdecl _imp_KeInitializeSpinLock" __imp_KeInitializeSpinLock
0x1C0017000: NpfsDriverObject
0x1C0005040: NpAliasListByLength
0x1C0014C6C: NpInternalWrite
0x1C00071C0: "__cdecl _imp_PsGetJobSilo" __imp_PsGetJobSilo
0x1C0007360: "__cdecl _imp_KeReleaseSpinLock" __imp_KeReleaseSpinLock
0x1C0003450: "Sessions\%ld\BaseNamedObjects\%w" ??_C@_1EM@CLHBCBMP@?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?2?$AA?$CF?$AAl?$AAd?$AA?2?$AAB?$AAa?$AAs?$AAe?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?2?$AA?$CF?$AAw@
0x1C0003138: "ClientProcessId" ??_C@_0BA@JIDJAHPK@ClientProcessId?$AA@
0x1C00072F8: "__cdecl _imp_PsDereferenceSiloContext" __imp_PsDereferenceSiloContext
0x1C000CD90: NpFsdFileSystemControl
0x1C000F980: NpFastRead
0x1C0007150: "__cdecl _imp_IoReleaseCancelSpinLock" __imp_IoReleaseCancelSpinLock
0x1C0001500: memcpy
0x1C0007028: "__cdecl _imp_RtlConvertSidToUnicodeString" __imp_RtlConvertSidToUnicodeString
0x1C0007120: "__cdecl _imp_ObLogSecurityDescriptor" __imp_ObLogSecurityDescriptor
0x1C00072C8: "__cdecl _imp_RtlSetGroupSecurityDescriptor" __imp_RtlSetGroupSecurityDescriptor
0x1C0007340: "__cdecl _imp_KeInitializeDpc" __imp_KeInitializeDpc
0x1C0007018: "__cdecl _imp_RtlSubAuthoritySid" __imp_RtlSubAuthoritySid
0x1C0007278: "__cdecl _imp_SeTokenType" __imp_SeTokenType
0x1C0007258: "__cdecl _imp_IoDeleteDevice" __imp_IoDeleteDevice
0x1C0010788: NpCreateDevice
0x1C00072A8: "__cdecl _imp_RtlAbsoluteToSelfRelativeSD" __imp_RtlAbsoluteToSelfRelativeSD
0x1C000131D: "__cdecl _C_specific_handler" __C_specific_handler
0x1C0001500: memmove
0x1C00152D8: NpSiloArrivalFsCtl
0x1C00072B8: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x1C00072F0: "__cdecl _imp_PsDetachSiloFromCurrentThread" __imp_PsDetachSiloFromCurrentThread
0x1C000E090: NpWriteDataQueue
0x1C0007098: "__cdecl _imp_SeAppendPrivileges" __imp_SeAppendPrivileges
0x1C0001354: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C000E8B0: NpSetListeningPipeState
0x1C001343C: NpQueryDirectory
0x1C0016170: NpFsdQueryVolumeInformation
0x1C000A5E0: NpCreateCcb
0x1C00031D8: "ServerProcessId" ??_C@_0BA@LBAMINND@ServerProcessId?$AA@
0x1C0007328: "__cdecl _imp_PsIsHostSilo" __imp_PsIsHostSilo
0x1C000D5D0: NpFsdRead
0x1C000EAE0: NpGetAttributeFromList
0x1C0003128: "LOCAL\" ??_C@_1O@GOAEMMLI@?$AAL?$AAO?$AAC?$AAA?$AAL?$AA?2?$AA?$AA@
0x1C0005068: NpAliasList
0x1C0001D10: NpCancelListeningQueueIrp
0x1C0007370: "__cdecl _imp_ObfReferenceObject" __imp_ObfReferenceObject
0x1C00070E8: "__cdecl _imp_PsGetThreadProcessId" __imp_PsGetThreadProcessId
0x1C00070D8: "__cdecl _imp_RtlInsertUnicodePrefix" __imp_RtlInsertUnicodePrefix
0x1C00138D4: NpEventsEnum
0x1C0007138: "__cdecl _imp_PsGetProcessSessionId" __imp_PsGetProcessSessionId
0x1C000FEE0: NpCommonQueryInformation
0x1C00011D0: NpCancelWaiter
0x1C000FD80: NpSetPipeInfo
0x1C0007048: "__cdecl _imp_RtlPrefixUnicodeString" __imp_RtlPrefixUnicodeString
0x1C000EF60: NpFsdCleanup
0x1C0007050: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C00071F8: "__cdecl _imp_MmUserProbeAddress" __imp_MmUserProbeAddress
0x1C000DC00: NpFastWrite
0x1C0015E80: NpDeleteSymlinkAccessCheck
0x1C000A2D0: NpWaitForNamedPipe
0x1C0012FD4: NpCompleteStalledWrites
0x1C000FC40: NpFreeProtectedPrefix
0x1C000FE80: NpFsdQueryInformation
0x1C00070C8: "__cdecl _imp_strncmp" __imp_strncmp
0x1C000A578: NpEventsDisconnectCompleted
0x1C001468C: NpInternalRead
0x1C0007348: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x1C0013C80: NpQueryPipeInfo
0x1C00183B8: NpReadParameters
0x1C0007020: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x1C0007148: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C0007000: "__cdecl _imp_RtlQueryRegistryValuesEx" __imp_RtlQueryRegistryValuesEx
0x1C00033E0: "Sessions\%ld\AppContainerNamedOb" ??_C@_1GE@DFAMFIC@?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?2?$AA?$CF?$AAl?$AAd?$AA?2?$AAA?$AAp?$AAp?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb@
0x1C0007090: "__cdecl _imp_KeLeaveCriticalRegion" __imp_KeLeaveCriticalRegion
0x1C0013E78: NpQueryPositionInfo
0x1C00100A8: NpSetAttributeInList
0x1C0007238: "__cdecl _imp_PsReferenceImpersonationToken" __imp_PsReferenceImpersonationToken
0x1C0015044: NpSetAttribute
0x1C000ED00: NpSetDisconnectedPipeState
0x1C0001330: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C0007280: "__cdecl _imp_RtlSetOwnerSecurityDescriptor" __imp_RtlSetOwnerSecurityDescriptor
0x1C0007168: "__cdecl _imp_IoAllocateMdl" __imp_IoAllocateMdl
0x1C0007308: "__cdecl _imp_RtlRemoveUnicodePrefix" __imp_RtlRemoveUnicodePrefix
0x1C0007198: "__cdecl _imp_ExRaiseStatus" __imp_ExRaiseStatus
0x1C0003158: "\Device\NamedPipe" ??_C@_1CE@NKNMNDKL@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAd?$AAP?$AAi?$AAp?$AAe?$AA?$AA@
0x1C00072A0: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1C00070A8: "__cdecl _imp_ExAllocatePoolWithQuotaTag" __imp_ExAllocatePoolWithQuotaTag
0x1C0007118: "__cdecl _imp_SeExports" __imp_SeExports
0x1C001446C: NpEnumEvents
0x1C0007178: "__cdecl _imp_ExReleasePushLockSharedEx" __imp_ExReleasePushLockSharedEx
0x1C00031C0: "CompatFlags" ??_C@_1BI@OMNPOLON@?$AAC?$AAo?$AAm?$AAp?$AAa?$AAt?$AAF?$AAl?$AAa?$AAg?$AAs?$AA?$AA@
0x1C000AF10: NpFsdCreateNamedPipe
0x1C000C390: NpCreateNewNamedPipe
0x1C0013BA4: NpQueryNameInfo
0x1C0015BEC: NpCreateSymlinkAccessCheck
0x1C000DDC0: NpCommonWrite
0x1C0010BE4: NpCommonQuerySecurityInfo
0x1C000F460: NpSetClosingPipeState
0x1C00148AC: NpInternalTransceive
0x1C0014530: NpGetAttribute
0x1C00031A0: "Npfs\Parameters" ??_C@_1CA@LOKEKBOI@?$AAN?$AAp?$AAf?$AAs?$AA?2?$AAP?$AAa?$AAr?$AAa?$AAm?$AAe?$AAt?$AAe?$AAr?$AAs?$AA?$AA@
0x1C000B540: NpFsdCreate
0x1C00011B0: NpClearSecurity
0x1C000FCA0: NpFsdSetInformation
0x1C000E9C0: NpQueryClientProcess
0x1C00020E0: NpTimerDispatch
0x1C0018010: GsDriverEntry
0x1C0007380: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0014E70: NpRemoveAllAttributesFromList
0x1C0007060: "__cdecl _imp_RtlGetAppContainerParent" __imp_RtlGetAppContainerParent
0x1C0007240: ExEventObjectType
0x1C000EBA0: NpDisconnect
0x1C0007200: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C00130A4: NpRemoveDataQueueEntry
0x1C001604C: NpCommonQueryVolumeInformation
0x1C0013D20: NpQueryPipeLocalInfo
0x1C0013F48: NpQueryStandardInfo
0x1C00072E0: "__cdecl _imp_PsCreateSiloContext" __imp_PsCreateSiloContext
0x1C00155B8: NpUnlinkCcb
0x1C0015668: NpUnlinkFcb
0x1C0007010: "__cdecl _imp_RtlGetAppContainerSidType" __imp_RtlGetAppContainerSidType
0x1C000A4E8: NpEventsReadCompleted
0x1C000CCDC: NpOpenNamedPipeRootDirectory
0x1C00140B0: NpCreateSymlinkFsCtl
0x1C00071B0: "__cdecl _imp_KeResetEvent" __imp_KeResetEvent
0x1C00071F8: MmUserProbeAddress
0x1C00070B8: "__cdecl _imp_IoGetFileObjectGenericMapping" __imp_IoGetFileObjectGenericMapping
0x1C00131D0: NpFsdDirectoryControl
0x1C00072C0: "__cdecl _imp_SeSetSecurityDescriptorInfo" __imp_SeSetSecurityDescriptorInfo
0x1C000EFC0: NpCommonCleanup
0x1C00012E0: "__cdecl _security_check_cookie" __security_check_cookie
0x1C000F880: NpCheckForNotifyWithFilter
0x1C0018208: NpInitializeAliases
0x1C0007310: "__cdecl _imp_RtlInitializeUnicodePrefix" __imp_RtlInitializeUnicodePrefix
0x1C0007390: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C0007290: "__cdecl _imp_SeQuerySecurityDescriptorInfo" __imp_SeQuerySecurityDescriptorInfo
0x1C00071F0: "__cdecl _imp_ObReferenceObjectByHandleWithTag" __imp_ObReferenceObjectByHandleWithTag
0x1C00102BC: NpUnlinkNode
0x1C0009000: NpSiloSlot
0x1C00070E0: "__cdecl _imp_SeOpenObjectAuditAlarm" __imp_SeOpenObjectAuditAlarm
0x1C0007170: "__cdecl _imp_ProbeForWrite" __imp_ProbeForWrite
0x1C00071E0: "__cdecl _imp_PsJobType" __imp_PsJobType
0x1C0018450: NpReadAlias
0x1C00105F8: NpOpenNamedPipePrefix
0x1C0007300: "__cdecl _imp_PsAllocSiloContextSlot" __imp_PsAllocSiloContextSlot
0x1C0019000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C00031F8: "ClientComputerName" ??_C@_0BD@DLEADINN@ClientComputerName?$AA@
0x1C0003000: "__cdecl load_config_used" _load_config_used
0x1C00071D8: "__cdecl _imp_PsDereferencePrimaryToken" __imp_PsDereferencePrimaryToken
0x1C0007080: "__cdecl _imp_ExReleasePushLockExclusiveEx" __imp_ExReleasePushLockExclusiveEx
0x1C0007130: "__cdecl _imp_PsGetProcessId" __imp_PsGetProcessId
0x1C0001DCC: NpAddWaiter
0x1C0007100: "__cdecl _imp_PsGetThreadSessionId" __imp_PsGetThreadSessionId
0x1C0007248: "__cdecl _imp_PsDereferenceImpersonationToken" __imp_PsDereferenceImpersonationToken
0x1C0007108: "__cdecl _imp_SeLockSubjectContext" __imp_SeLockSubjectContext
0x1C0014268: NpDeleteSymlinkFsCtl
0x1C0010820: NpInitializeVcb
0x1C00070F8: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C0010300: NpFsdSetSecurityInfo
0x1C000B310: NpTranslateAlias
0x1C0007070: "__cdecl _imp_ExTryAcquirePushLockExclusiveEx" __imp_ExTryAcquirePushLockExclusiveEx
0x1C0001010: NpCancelDataQueueIrp
0x1C0007160: "__cdecl _imp_FsRtlIsNameInExpression" __imp_FsRtlIsNameInExpression
0x1C00071D0: "__cdecl _imp_IoFreeIrp" __imp_IoFreeIrp
0x1C000A544: NpGetNextRealDataQueueEntry
0x1C0013278: NpNotifyChangeDirectory
0x1C00014B0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C00013D0: memcmp
0x1C0007190: "__cdecl _imp_MmMapLockedPagesSpecifyCache" __imp_MmMapLockedPagesSpecifyCache
0x1C0015F60: NpOpenSymlink
0x1C0007208: "__cdecl _imp_PsReferencePrimaryToken" __imp_PsReferencePrimaryToken
0x1C0007210: "__cdecl _imp_PsGetCurrentProcess" __imp_PsGetCurrentProcess
0x1C0005028: NpCompatFlags
0x1C0007110: "__cdecl _imp_SeSinglePrivilegeCheck" __imp_SeSinglePrivilegeCheck
0x1C000A008: NpQueryClientProcessImpl
0x1C00071B8: "__cdecl _imp_KeBugCheckEx" __imp_KeBugCheckEx
0x1C00034A0: "Sessions\%ld\AppContainerNamedOb" ??_C@_1FM@NBDGOAAG@?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?2?$AA?$CF?$AAl?$AAd?$AA?2?$AAA?$AAp?$AAp?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb@
0x1C0007268: "__cdecl _imp_SeImpersonateClientEx" __imp_SeImpersonateClientEx
0x1C00072E8: "__cdecl _imp_PsInsertPermanentSiloContext" __imp_PsInsertPermanentSiloContext
0x1C0007338: "__cdecl _imp_KeAcquireSpinLockRaiseToDpc" __imp_KeAcquireSpinLockRaiseToDpc
0x1C0014050: NpFsdFlushBuffers
0x1C0007318: "__cdecl _imp_RtlFindUnicodePrefix" __imp_RtlFindUnicodePrefix
0x1C0007218: "__cdecl _imp_SeDeleteAccessState" __imp_SeDeleteAccessState
0x1C00070F0: "__cdecl _imp_SeUnlockSubjectContext" __imp_SeUnlockSubjectContext
0x1C0007320: "__cdecl _imp_FsRtlTeardownPerStreamContexts" __imp_FsRtlTeardownPerStreamContexts
0x1C0005000: "__cdecl _security_cookie" __security_cookie
0x1C0007368: "__cdecl _imp_KeCancelTimer" __imp_KeCancelTimer
0x1C0012F28: NpUninitializeAliases
0x1C0001FD0: NpCancelWaitQueueIrp
0x1C00070A0: "__cdecl _imp_SeFreePrivileges" __imp_SeFreePrivileges
0x1C0007128: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x1C000D280: NpTransceive
0x1C0001B90: RtlUnicodeStringPrintf
0x1C0003180: "Npfs\Aliases" ??_C@_1BK@CPEPECEF@?$AAN?$AAp?$AAf?$AAs?$AA?2?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?$AA@
0x1C00161B8: NpQueryFsVolumeInfo
0x1C0003110: "NamedPipe" ??_C@_1BE@LGPILPHH@?$AAN?$AAa?$AAm?$AAe?$AAd?$AAP?$AAi?$AAp?$AAe?$AA?$AA@
0x1C0012F4C: NpLocateEa
0x1C0007358: "__cdecl _imp_KeInitializeTimer" __imp_KeInitializeTimer
0x1C0007008: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x1C0007180: "__cdecl _imp_IoFreeMdl" __imp_IoFreeMdl
0x1C0003148: "ClientSessionId" ??_C@_0BA@IHMEBOFB@ClientSessionId?$AA@
0x1C0018044: "__cdecl _security_init_cookie" __security_init_cookie
0x1C0001C50: NpCancelChangeNotifyIrp
0x1C000E4D0: NpReadDataQueue
0x1C0005070: NpAliases
0x1C0007030: "__cdecl _imp_RtlUpcaseUnicodeString" __imp_RtlUpcaseUnicodeString
0x1C000FFB0: NpImpersonate
0x1C00071A8: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C00071E0: PsJobType
0x1C000FB90: NpUnlinkProtectedPrefix
0x1C0003500: "NPFS" ??_C@_19MJJJBKGB@?$AAN?$AAP?$AAF?$AAS?$AA?$AA@
0x1C0007078: "__cdecl _imp_ExAcquirePushLockExclusiveEx" __imp_ExAcquirePushLockExclusiveEx
0x1C0010364: NpCommonSetSecurityInfo
0x1C0014EC4: NpRemoveAttributeFromList
0x1C0007298: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1C0001310: "__cdecl _report_gsfailure" __report_gsfailure
0x1C00071C8: "__cdecl _imp_SeCreateAccessState" __imp_SeCreateAccessState
0x1C000DCE0: NpFsdWrite
0x1C000F8B4: NpCommonFlushBuffers
0x1C00129F0: NpTranslateContainerLocalAlias
0x1C000CC10: NpFindPrefix
0x1C000D890: NpAddDataQueueEntry
0x1C0005020: NpCcbIndexGenerator
0x1C000EE30: NpFsdClose
0x1C0007378: ntoskrnl_NULL_THUNK_DATA
0x1C0007058: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C000EC90: NpFreeClientSecurityContext
0x1C00070D0: "__cdecl _imp_ObDereferenceSecurityDescriptor" __imp_ObDereferenceSecurityDescriptor
0x1C0007068: "__cdecl _imp_KeEnterCriticalRegion" __imp_KeEnterCriticalRegion
0x1C0007288: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x1C0018080: DriverEntry
0x1C0007270: "__cdecl _imp_SeCreateClientSecurity" __imp_SeCreateClientSecurity
0x1C0001840: memset
0x1C00073A4: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C00031E8: "ServerSessionId" ??_C@_0BA@KOPBJEHI@ServerSessionId?$AA@

[JEB Decompiler by PNF Software]